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BY ALAN D. JONES 


igital pagers, or beepers as 
ithey’re commonly called, 
have become exceedingly 
popular in the past decade. Pagers of 
all kinds are clipped to the belts of 
millions of people today, and it’s quite 
likely that one of those people is you. 

Asignal intended for a digital pag- 
er consists, among other things, of an 
individual pager address followed by 
the message to be displayed on the 
pager, Note that the word “digital” 
here refers to any pager that receives 
binary data, Including both numeric 
(digits only) and alphanumeric (full 
text) pagers, The majority of messages 
In a broadcast will be simple tele- 
phone numbers or digit codes, but 
people with alphanumeric pagers 
are Increasingly making use of de- 
failed text messages, often of consid- 
erable length. 

But how do you know if the mes- 
sages being transmitted are being re- 
ceived correctly? There's no backup 
message generated by paging ser- 
vices, and you therefore have no way 
of determining if you're getting the 
whole message. What's needed is a 
way of getting a second look at a 
message, 

The Alphanumeric Pager Decoder 


Catch beeper messages from the 


described in this article, together with 
ascanner radio and a PC, will permit 
you to decode the messages that are 
transmitted to about 80 or 90 percent 
of beepers that are commercially 
available, and view them on your 
computer screen. You could, for ex- 
ampie, keep a log on disk of all mes- 
sages transmitted to your own pager 
and verify that all were received by 
the beeper. Also, corporations could 
keep time-stamped logs of all mes- 
sages sent to their in-house pagers. 

Units like the Decoder are quite 
effective, and for this reason are even 
used by law-enforcement agencies. 
With such high-tech help, the good 
guys in blue can keep tabs on the 
dealings of known nefarious charac- 
ters. 


How Pages are Transmitted. 
Paging channels can be found scat- 
tered around the VHF (152 MHz) and 
UHF (454 MHz) bands. In most metro- 
politan areas, a large number of pag- 
ing channels can be found within the 
dedicated paging band fromm 929 to 
932 MHz. To discover the frequency 
used by a specific paging service, just 
look at one of their pagers. There will 
almost always be a sticker indicating 


the reception frequency. 

Pager signals of the type we are 
interested in here are modulated by 
the “direct FSK" method. This means 
that the RF carrer is switched be- 
tween center frequency +4.5 kHz 
and center frequency —4.5 kHz, to 
represent binary “1” and "0," respec- 
tively. Bit rates currently range from 
300 to 2400 bits per second. 

The most commonly used data for- 
mat is POCSAG (Post Office Code 
Standard Advisory Group), This coding 
standard was devised in a series of 
meetings of industry representatives 
hosted by British Telecorn in 1978 and 
4980. POCSAG is a 32-bits-per-word 
synchronous error-correcting code 
using a 17-word frame. It is broadcast 
at 512, 1200, and 2400 bits per sec- 
ond, On most paging channels you 
will hear the signal switching rapidly 
between different bit rates as various 
pagers are addressed, To learn to rec- 
ognize POCSAG by Its distinctive 
sound, just use the search mode on 
your scanner in the 929- to 932-MHz 
range. About 90 percent of the signals 
you hear will be POCSAG atone of the 
three standard bit rates (see the 
“POCSAG Messages” box for more in- 
formation). 
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Fig. J. Here is the schematic for the Alphanumeric Pager Decoder. Many sections of 
the circuit take their power from two pins of a PC serial port, through DB-25- 
connector SOI. Regulator [C3 also converts that power to a 5-volt source for use by 


other parts of the circuit. 


Using Your Scanner. A perfectly de- 
modulated paging signal should ap- 
pear on an oscilloscope as a series of 
rectangular pulses of varying width 
(squarewaves), This signal exists at 
some point within the circuitry of any 
radio receiver. Unfortunately, most 
low- to moderate-cost scanners were 
designed specifically to listen to voice 
transmissions. As a result, that nice 
clean squarewave passes through 
several stages of lowpass and high- 
pass audio filtering to optimize the 
sound quality from the speaker. The 
result is that the signal available atthe 
external speaker or earphone jack 
bears little resemblance fo the origi- 
hal source. 

One of the functions of the De- 
coder is that of reconstructing the 
original data waveform from the high- 
ly distorted waveform available at the 
audio output of a typical scanner. Ex- 


amination of the outputs of several 
popular scanners reveals certain 
common characteristics. One of 
these is that all DC information is lost; if 
along string of 1's or 0's is encountered 
(no bit transitions), the output quickly 
settles to a center zero point re- 
gardiess of the polarity of the binary 
data. Another is that any bit transition 
causes an initial spike of the proper 
polarity followed by a moderate-tfo- 
severe overshoot of the opposite po- 
larity. The second overshoot (back in 
‘the original direction) is usually well- 
damped and of much lower ampli- 
tude. To make matters worse, the 
“tinging” frequency is offen roughly 
equal to half the bit rate of a 1200-bps 
data stream, causing transition-in- 
duced spikes to sometimes super- 
pose themseives on the first overshoot 
from a previous transition. 

Tne Decoder atiempis fo recon- 


struct the original data by the use of a 
Schmitt trigger. There are two oppor- 
tunities for trigger points on the audio 
waveform: the initial spike and the first 
overshoot. Which one is best depends 
on whether or not the amplitude of 
the initial spike Is significantly higher 
than the first overshoot. The general 
lack of a major second overshoot is 
the detail that allows us to get away 
with using the first overshoot instead of 
the spike. For any particular scanner, 
direct experimentation will determine 
the best location for the trigger points. 
Ifyour scanner has a “discriminator” 
or raw-data output, then you should 
by all means use if with the Decoder. 
Most do not, however. So, as we'll see 
later, you will probably have to locate 
this unadulterated signal within the in- 
ternal circuitry of the scanner. A little 
work with a soldering iron can bring 
out an extra pair of wires {or a jack) 


providing the desired output. Be- 
cause of the audio filtering, you can 
normally decode 1200-bps and lower 
transmissions, but its pretty hopeless 
to extract useful data at 2400 bps 
without a direct discriminator output. 

Just because you have an accu- 
tately reconstructed binary data 
stream doesn’t mean that the prob- 
lem of interpreting pager signals is 
solved, We could fry level-transiating 
the signal to RS-232 voltages and 
feeding It into a serial port, but the 
following must be considered: (1) bit 
rates may change unexpectedly, and 
(2) POCSAG Is a 32-bit synchronous 
format that is incompatible with the 
data input mechanism of the type of 
UART that is normally used in PCs, 

There is some temptation to solve 
both of these difficulties by feeding 
the signal fo a “handshake” line of the 
serial port (instead of the normal data 
line) and using highly timing-intensive 
software to measure Individual bit 
transitions in order to determine the 
current bit rate and extract the cor- 
rectly synchronized data words. In 
fact, there exist products on the mar- 
ket that do exactly this, and the inge- 
nuity that must have been required to 
write such software Is something to be 
admired, The disadvantage of this 
approach js that the software running 
on the PC must perform timing tasks at 
the sub-millisecond level in a way that 
essentially prohibits operation under 
multitasking operating systems such 
as Microsoft Windows. Such programs 
tend to run under MS-DOS only and 
must “own" all the CPU time in order to 
function correctly, 

The Decoder overcomes this disad- 
vantage by adding one more pro- 
cessing step between the recon- 
structed data stream and the PC 
serial port. A Microchip PIC16C54 mi- 
croprocessor Is used to reformat the 
data into a form that is acceptable to 
a standard PC UART. In order to retain 
the versatility and general ap- 
plicability of this device for future ap- 
plications in decoding other digital 
data stream formats, the embedded 
software forthe PIC CPU operates sim- 
ply as a constant-rate sampler, con- 
tinuously taking samples of the state 
of the data stream at approximately 
9600 samples per second. Each time 
@ group of eight sampies has been 
accumulated, the group is iransmit- 
ted to the PC serial port as a conven- 


tional asynchronous byte, including 
start and stop bits, at 19,200 bps. This 
amounis to four samples per bit at a 
2400-bps incoming data rate (more 
for lower rates), which is adequate for 
purposes of software-based bit syn- 
chronization. 

The work of determining the data 
rate and subsequently converting the 
data to a usable one-bit-per-data-bit 
stored format is still handled by the PC 
itself. The advantage of this method is 
that, since data is received by the PC 
serial port in the standard way, the 
usual operating-system-supplied se- 
tial port device drivers can be used to 
receive and initially buffer the data. 
This buffer can be occasionally read 
and analyzed by an application pro- 
gram that, because of the buffering in 
the device driver, can easily run in a 
multitasking environment. 

The writing of PC software to bit- 


syne, word-sync, error-correct, de- 
code, and display the data stream 
from this device would be a project of 
greater magnitude than the physical 
construction itself, However, a pro- 
gram that performs these functions 
under either Microsoft Windows 3.1 or 
Microsoft Windows 95 is available at 
no charge via the Internet at http:// 
www.cylexinc.com/download.him or 
from ftp.gernsback.com, This pro- 
gram decodes POCSAG at all three 
standard rates; if you need to decode 
another coding format, you will need 
to write your own software for now. 
Note that any program accepting 
data from this device must be capa- 
ble of accommodating a never-end- 
ing stream of 19200-baud data and 
performing a fair amount of com- 
Putation on that data at real-time 
speeds, It is necessary to use a rea- 
sonably fast PC fo run such a pro- 


PARTS LIST FOR THE 
ALPHANUMERIC PAGER DECODER 


SEMICONDUCTORS 

ICI—PICI6CS4 preprogrammed 
microcontroller, integrated circuit 

IC2—LF444CN quad low-power op- 
‘amp, integrated circuit 

1C3—LP2950CZ low drop-out 5-volt 
regulator, integrated circuit 

QI—2N3906 general-purpose PNP 
silicon transistor 

Q2, Q3—2N3904 general-purpose 
NPN silicon transistor 

DI-D6—IN4148 general-purpose 
silicon diode 

LEDI—Light-emitting diode, 3-mm 
diameter, red 


RESISTORS 

(All resistors are Y-watt, 5% units.) 
RI, R2, RS, R7, R8—47,000-ohm 
R3, Ril, R12, R18—10,000-ohm 
R4, R1IS—200,000-ohm 

R6, RI7—2200-ohm 

R9, RI3—470,000-ohm: 
R10—4700-ohm 
R14—68,000-ohm 

R16, R20—100,000-ohm 
Ri9—100-ohm 


CAPACITORS 

Cl, C2—15-pF, ceramic-dise 

€3—0.022-4F Mylar 

C4, C6, C8—I-pF 16-WVDC, 
tantalum 

C5, ClO—0.001-4F, ceramic-disc 

C7—47-pE, ceramic-dise 

C9—L-yE nonpolarized Mylar (see 
text) 


ADDITIONAL PARTS AND MATERIALS 

XTALI—4-MHz crystal in HC-49/ 
US package 

Ji, J2—3.5-mm mono phono jack 

SOl—DB-25 female connector with 
solder-cup terminals 

HI, H2—Two-pin header (right-angle 
break-off pin strip, 0.1-inch. 
spacing) 

Printed-circuit materials, DB-25 
connector hood designed to 
accommodate a DB-25 at both 
ends, jumper shunts (0.1-inch 
spacing) to fit Hl and H2, cable 
with a 3.5-mm plug on each end, 
wire, solder, hardware, etc. 


Note: The following items are 
available from Cylex Inc. (2501 
Afton Court, League City, TX 
77573-3438; Tel. 800-356-7047; 

, Fax: 713-332-4730): double-sided 
etched and drilled PC board with 
matching plastic case-—$25,00; kit 
of parts including pre-programmed 
PIC16C54 (no board or case}— 
$35.00; pre-programmed 
PICI6C54 only—$11.00. When 
ordering by mail add $5.00 
shipping and handling to all 
orders. Texas residents please add 
an additional 7.25% sales tax. 
Visa, MasterCard, American 
Express, and Discover cards will 
be accepted. A floppy disk 
containing the AccuPage Radio 
Monitor program will be included 
free of charge with all orders. 
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gram; we recommend a 33 MHz 486 
as a minimum, 


Circuit Description. The schematic 
for the Decoder is shown in Fig. 1. 
Basically, the circuit consists of four 
blocks: the power supply, input-signal 
processing, Schmitt trigger, and dig- 
ital sampler/UART. All necessary power 
is drawn from the handshake lines of 
the serial port itself. The request-to- 
send line (pin 4 of SO1) provides 
negative voltage and the data-termi- 
nal-ready line (pin 20 of SO1) provides 
positive voltage {software must set 
these outputs appropriately). Reg- 
ulatorIC3 creates a 5-volt logic supply 
for microcontroller IC‘. The RTS line 
(negative supply) doubles as a reset 
control for IC1 when it is set momen- 
tarily positive, while the data-output 
line from the PC serves as a separate 
negative supply to produce the nec- 
essary vollage swing to drive the PC's 
data Input at RS-232 levels. 

Resistor R19 Is a simulated speaker 
load for the scanner if needed. Com- 
ponents R18 and C10 form a lowpass 
filter to remove the 455-kHz IF compo- 
nents (and harmonics) that are often 
present at discriminator outputs. Both 
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Fig. 2. This is the solder side of the 
Decoder circuit board. 
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Fig, 3, Here's the component side of the 
board. 


A properly assembled Decoder PC board will fit inside a DB-25 connector hood, 


C9 and R20 eliminate any undesired 
DC componenis that may exist in the 
scanner signal. One section of an 
LF444CN, IC2-a, is simply a buffer and 
gain block with two jumper-selecta- 
ble gain settings; |C2-c buffers the sig- 
nal to the auxiliary speaker output. 

Section |C2-d and its associated 
feedback components form a 
Schmitt trigger with thresholds of ap- 
proximately +0.1 and —0.1 volts. Ca- 
pacitor C5, section IC2-b, and their 
associated resistors are set up to 
cause LED1 fo flash on each negative 
transition of the Schmitt trigger output 
as an aid in setting the scanner out- 
put-level control. Transistor Q2 con- 
veris the rail-to-rail swing from IC2-d 
to logic levels for input to micro- 
controller IC1, a PIC16C54. 

The PIC contains on-chip PROM 
that must be programmed with the 
small program whose source code 
and compiled hex file can be down- 
loaded from the Cylex Internet site 
mentioned earlier, or the Gernsback 
FIP Pre-programmed chips are also 
available from a source mentioned in 
the Parts List. This program is clock- 
rate sensitive and will not work unless 
a 4-Miz crystal is used. 


Construction. Layout of the circuit is 
non-critical. For that reason, any rea- 
sonable breadboard assembly tech- 
nique can be used fo build the 
Decoder. The only precautions you'd 
have to foilow are: (1) Be sure that 
crystal XTAL1 and its shunt capacitors 
C1 and C2 are close to micro- 
controller |C1 with short lead lengths, 
and (2) Keep C8 close to IC3, and C3. 
close to IC1. However, when it comes 
to size, building the circuit on a bread- 


board Is not desirable, 

For the most compact assembly, 
you might want to build the circuit in 
the fashion the prototype was as- 
sembled—on a double-sided 
printed-circuit board, That way, the 
entire circuit will fit inside a plastic 
DB-25 connector shell. If you'd like to 
etch your own double-sided PC 
board, you can use the solder- and 
component-side foil patterns shown 
in Figs. 2 and 3, respectively, Or, you 
can order a drilled and etched board 
from the source mentioned In the 
Parts List. 

If you build the Decoder on the cir- 
cuit board, use the parts-placement 
diagram shown in Fig. 4 as a guide, Be 
careful about the sequence In which 
you install the parts. Note that some of 
the discrete components in Fig, 4 are 
shown made up of dashed lines. 
Those mount on the solder side of the 
board directly under ICs, Solder those 
Parts in place and clip their leads be- 
fore you install ICs, Do not use sockets 
under the ICs if you plan to enclose 
the circuit in the plastic shell; there is 
simply not enough room. 

it is also important to solder all 
TO-92 parts (Q1, 2, Q3, and IC3) with 
their plastic cases all the way down to 
the board, again because of the 
shortage of room. Jacks J1 and J2 
and SO1 go against the edge of the 
board and some of their pins solder to 
each side. Be sure that SO1 is perfectly 
straight against the board edge or 
the connector shell will not fit. The LED 
should protrude through a hole in the 
connector sheil drilled or punched to 
accommodate it. Also, make sure that 
C9 is small enough to fit in the space 
allowed on the board. 
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Fig, 4, Use this parts-placement diagram as a guide when assembling the Decoder on 
a PC board. Note that the parts drawn with dashed lines are mounted on the 


component side of the board. 


Keeping all those assembly tips in 
mind, this is the recommended se- 
quence to optimize putting together 
the circuit board: Solder the two 3.5- 
mm phono jacks to the board, center- 
ing ther against the edge. The 
ground lug on each will need to be 
bent about 45 degrees in order to 
touch the pads on the board. Next 
mount the DB-25 connector to the 
board using only pins 1 and 13. Tem- 
porarily place the board into one side 
of the plastic shell. If things do not line 
up properly, reheat the solder joints 
and adjust the position of the con- 
nector. Then solder the remaining pins 
of the DB-25. 

Using the plastic shell half con- 
taining the LED hole as a guide, install 
the LED on the solder side of the 
board. Be sure to get the polarity cor- 
tect. We stress this because the in- 
stallation of 1C2 later will make 
desoldering of the LED difficult. Install 
C1,C2,C3,X1, R9, R13, R14, and R16.0n 
the solder side of the board as well. 
Leave about 1 mm of extra lead 
length on C1-C3 and bend these 
parts down flat against the board in 
the direction away from the crystal. 

Install all remaining paris on the 
component side of the board. Be sure 
that all parts, especially @1-Q3, and 


IC3, are flush against the board. Test 
the circuit before installing the plastic 
shell; the shell is difficult to take apart. 


Checkout and Adjustment. To 
power up and test the circuit, itis nec- 
essary to have either the AccuPage 
Radio Monitor program for the PC 
(mentioned earlier) or a test program 
that sets the COM port as follows: 
RTS=0, DIR=0 for at least 0.1 sec, fol- 
lowed by RTS=1, DIR=0 indefinitely. 
This resets IC1, then configures the 
lines to provide power. Start with the 
device connected to the COM port 
but nothing connected to J4 or J2. 
Measure the voltage (relative to cir- 
cuit ground) at IC1 pin 14 and IC2 pin 
4; these should be +5 volts and -6 to 
-44 volts respectively, The LED should 
not be lit. 

Next, tune your scanner fo an active 
paging frequency. Use an appropri- 
ate cable to connect the output of 
the scanner to J1. If you are using the 
speaker/earphone oufput of the 
scanner, install a connecting pin to 
header H1; remove it if you are usinga 
discriminator output (more on that 
later). Leave the pin on header H2 off, 
it is needed only in a small percent- 
age of cases with discriminaior out- 
puts and almost never with speaker 


outputs. If you are using a discrimi- 
nator output, then the following para- 
graph referencing volume-control 
settings does not apply; you should be 
able to just plug and go. If the LED 
does not come on during transmis- 
sions, then Install the pin on H2. 

Set the volume control to its mini- 
mum position. Connect a small 
speaker or earphone to J2. Be sure 
that the COM portis set correctly and 
that you check the “Enable” check- 
box near the top of the AccuPage Ra- 
dio Monitor screen, Gradually in- 
crease the volume setting until the 
LED begins to glow continuously dur- 
ing transmissions; stop at this point. Do 
not change the volume between 
transmissions; you will just be turning 
the control with no reference. During 
a paging transmission, the apparent 
intensity of the LED should appear to 
waver in sync with the sound you hear, 
but it should not go out except be- 
tween transmissions. (If you have an 
oscilloscope, connect one channel 
to pin 1 of C2 and the other to pin 9 of 
IC1 to see how the circuit is Interpret- 
ing the analog waveform, 

It is worth pausing here for a mo- 
ment to emphasize the importance 
of clean reception on the scanner. 
Move or re-orient the antenna as nec- 
essary! The sound you hear should be 
as free as possible from hiss or crack- 
ling noises, The sensitivity and selec- 
tivity of a wideband receiver is often 
not as good as that of a single-fre- 
quency pager receiver, and getting 
good reception is subsequently more 
difficult. 

Watch the “Signal” indicators near 
the top of the AccuPage Radio 
Monitor screen, The green to red ratio 
corresponds to the correct to errors 
tatio, The left indicator is the one to 
watch Initially; the right indicator al- 
ways starts at 100% bad” and repre- 
sents a cumulative weighted average 
over the last several seconds of valid 
data. We are looking for the left in- 
dicator to show mostly green, White 
indicates no valid data at all. If the 
indicator remains white, and the LED 
giows as described, try toggling the 
“Inverted Data” checkbox. Every 
scanner is different and the output 
polarity of yours may be backwards 
from the program's convention. 

if you just can’t seem to get any 
indication on the signal indicator, try 
increasing the volume setting by tiny 


incremental amounis, being sure to 
try both settings of “Inverted Data” at 
each position. Once the indicator 
shows some green, then keep adjust- 
ing the volume for best results (mini- 
mum red), If you are getting readings 
but are unable to reduce the “bad” 
(red) percentage to a small value, 
then approach from the other direc- 
tion, Set the Inverted Data checkbox 
to its opposite setting (to trigger on the 
overshoot as described earlier) and 
increase the volume to amuch higher 
setting. Then decrease the volume in- 
crementally, searching for an op- 
timum setting based on the Signal 
Indicators, 

The AccuPage Radio Monitor pro- 
gram by default logs and dispiays all 
messages that it decodes. If you 
would like to see only text messages, 
or to filter the messages so that only 
those for particular pagers are log- 
ged, select “File/Search List” from the 
menu bar. A typical paging service 
might easily transmit 100,000 pages 
per day, and the message log file 
generated by logging all of them will 
rapidly grow to a size of many mega- 
bytes, 


Troubleshooting. The following are 
some of the most likely reasons why 
the device might not work properly: 


(1) Connector problems at the scan- 
ner output. 

(2) Wrong COM port set up in soff- 
ware. 

(3) “Inverted Data” setting is incorrect. 

(4) Computer is to0 slow (use a 486/33 
or faster). 

(5) Weak or noisy radio reception. 

(6 Wrong settings for pins in H4 and 
H2. 


(7) The recelved signal is not direct 
FSK. 

(8) Wrong scanner demodulation 
mode (should be narrow FM). 

(9) The received signal is not POCSAG. 
(there are other paging formats) 

(10) Soldering problems, wiring errors, 
damaged components, etc. 


Obtaining Unfiltered Scanner 
Audio. Every scanner is different, and 
it would be difficult to provide specific 
instructions for tapping into the un- 
filtered demodulator output for every 
type of scanner on the market 
(though we will give tips for one later 
on). Here are some general sugges- 
tions: 


First of all, get a schematic of the 
scanner Without this, you still might 
have success, but it’s going fo take an 
oscilloscope and a lot of patience. 

Look for the audio amplifier circuit. 
This will usually consist of two or three 
stages of amplification, probably with 
second-order lowpass filter and a 
second-order highpass filter some- 
where in the chain. Try to obtain a 
take-off point at the beginning of the 
amplifier chain. The signal here will 
probably be only a few tenths of a 
voit, should look like square waves, 
and is likely to have a lot of 910 kHz 
superimposed on it (twice the lowest 
IF. 

As an alternative (particularly if you 


don’t have a schematic), look for the 
FM demodulator. In many scanners, 
this is the popular Motorola MC3361 
chip. If you find one of these in your 
scanner, then pin 9 is the unfiltered 
demodulator output, Depending on. 
the external circuitry, it is possible that 
pin 11 is also a good place to get a 
signal. Use an oscilloscope if possible 
to select the “squarest-looking” signal, 
In addition to the signal take-off 
point, you must of course also bring 
out the scanner’s circult ground. 
Warning: In some handheld scanners 
we have examined, the “case” side of 
the external speaker jack is not 
grounded. Look on the circuit boards 
(Continued on page 60) 


